I've managed to create a search which will list for me all installed packages on a particular host, but I need to have a list of packages with the version number. Any idea how I can modify/improve this search to give me this?
host=[hostname] sourcetype=package | multikv noheader=t | rex "(?
Here's what I use to pull all software installed on Linux machines.
A different type of output show hosts and installed software:
sourcetype=package index=os
| multikv noheader=t
| rex field=_raw "^(?P[^ ]+)\s+(?P[^ ]+)\s+(?P[^ ]+)\s+(?P\w+)"
| search NOT NAME NOT VERSION NOT RELEASE NOT ARCH
| dedup host package version release arch
|table host package version release arch
In fact what I need is even easier:
index=os host="[hostname]*" sourcetype=package | dedup host
If you have a version field then modify your search. Notice that I also sorted it in descending order and only display top 10.
host=[hostname] sourcetype=package | multikv noheader=t | rex "(?<package>S+)" | stats dc(host) as dc by package,version | sort - dc | head 10